elastic/elasticsearch · error · IllegalArgumentException

invalid source port [{}]

Error message

invalid source port [{}]

What it means

Inside buildFlow for transport types Tcp/Udp/Sctp the parsed source port must satisfy 1 <= port <= 65535. Port 0 and values above 65535 are rejected, even though parseIntFromObjectOrString would have returned them as a valid int. The value as-provided (sourcePort.get()) is interpolated into the message.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CommunityIdProcessor.java:233

        Flow flow = new Flow();
        flow.source = InetAddresses.forString(sourceIpAddrString);
        flow.destination = InetAddresses.forString(destIpAddrString);

        Object protocol = ianaNumber;
        if (protocol == null) {
            protocol = transport.get();
            if (protocol == null) {
                return null;
            }
        }
        flow.protocol = Transport.fromObject(protocol);

        switch (flow.protocol.getType()) {
            case Tcp, Udp, Sctp -> {
                flow.sourcePort = parseIntFromObjectOrString(sourcePort.get(), "source port");
                if (flow.sourcePort < 1 || flow.sourcePort > 65535) {
                    throw new IllegalArgumentException("invalid source port [" + sourcePort.get() + "]");
                }
                flow.destinationPort = parseIntFromObjectOrString(destinationPort.get(), "destination port");
                if (flow.destinationPort < 1 || flow.destinationPort > 65535) {
                    throw new IllegalArgumentException("invalid destination port [" + destinationPort.get() + "]");
                }
            }
            case Icmp, IcmpIpV6 -> {
                // tolerate missing or invalid ICMP types and codes
                flow.icmpType = parseIntFromObjectOrString(icmpType, "icmp type");
                flow.icmpCode = parseIntFromObjectOrString(icmpCode, "icmp code");
            }
        }

        return flow;
    }

    @Override
    public String getType() {

View on GitHub (pinned to db6a809a66)

Solutions

1. Ensure source.port is an integer in [1,65535] for TCP/UDP/SCTP flows before community_id runs.
2. If port 0 is genuinely valid in your data, document/override the behavior upstream — the processor does not accept it.
3. For events where the port is genuinely unknown, leave network.transport unset or use an ICMP-typed transport so the port check is skipped.
4. Route failures through on_failure.

Example fix

// before — port 0 fails for a TCP flow
//   { "source": { "ip": "10.0.0.1" }, "source": { "port": 0 }, "network": { "transport": "tcp", "iana_number": 6 } }
//
// after — port in the valid 1..65535 range
//   { "source": { "ip": "10.0.0.1", "port": 54321 }, "destination": { "ip": "10.0.0.2", "port": 443 }, "network": { "transport": "tcp" } }

boolean isValidPort(Object o) {
    if (o instanceof Number n) { int p = n.intValue(); return p >= 1 && p <= 65535; }
    if (o instanceof String s && s.matches("-?\\d+")) {
        int p = Integer.parseInt(s); return p >= 1 && p <= 65535;
    }
    return false;
}

{
  "community_id": {
    "on_failure": [
      { "set": { "field": "ingest.error", "value": "community-id-bad-source-port" } },
      { "redirect": { "pipeline": "quarantine" } }
    ]
  }
}

When it happens

Trigger: A document whose source.port field is 0, negative, > 65535, or a Number/String that parses to such a value, with transport resolving to TCP/UDP/SCTP. Note: a null port resolves to 0 via parseIntFromObjectOrString and therefore also throws.

Common situations: Sensors emitting port 0 for 'any port'; ephemeral port fields mis-typed as signed short wrapping negative; hex string values that decode out-of-range; missing port field combined with a TCP/UDP transport.

Related errors

• invalid destination port [{}]
• unable to parse {} [{}]
• invalid transport protocol number [{}]
• could not convert string [{}] to transport protocol
• Unable to find pattern [{}] in Grok's pattern dictionary

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/afb7937d70a94e6c. Report an issue: GitHub.